Analysis
- max time kernel
46s - max time network
45s - platform
windows7_x64 - resource
win7-20220331-en - submitted
13/04/2022, 17:45
General
- Target emezx (1).exe
- Size 876KB
- Sample220413-wbpl9aebek
- SHA256 e9deef760186498e9b4d075c784b6170bc976a767652f4a5228215fd1b1841cc
Malware Config
Extracted
-
formbook
-
4.1
-
g02e
-
rankwrestles.com
-
dm285.com
-
0824e.com
-
smaduread.com
-
staygoodbossedup.com
-
actacricket.xyz
-
djpauloso.com
-
collingwoodwellbabyclinic.com
-
fazzamedia.com
-
faento.online
-
devoteddixons.com
-
ljconcierto.com
-
dallasmorningpost.com
-
changledi.com
-
sz-lyfw.com
-
askdigiguru.com
-
aihongyan.com
-
educanet12.com
-
accedabancsabadell.com
-
vetkoekworld.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\emezx (1).exe"C:\Users\Admin\AppData\Local\Temp\emezx (1).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\emezx (1).exe"C:\Users\Admin\AppData\Local\Temp\emezx (1).exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 363⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/852-58-0x0000000000400000-0x000000000042F000-memory.dmp
memory/852-61-0x0000000000400000-0x000000000042F000-memory.dmp
memory/852-59-0x0000000000400000-0x000000000042F000-memory.dmp
memory/876-54-0x0000000001190000-0x0000000001272000-memory.dmp
memory/876-55-0x0000000000480000-0x000000000048E000-memory.dmp
memory/876-56-0x0000000007DA0000-0x0000000007E5A000-memory.dmp
memory/876-57-0x0000000007E60000-0x0000000007ED8000-memory.dmp